On 13 November 2026, Cursor published the findings of its investigation into a security incident that allowed attackers to distribute a tampered copy of the Claude Code extension. The update clarifies how a compromised third-party access key escalated into a software supply-chain attack. This was not a compromise of Anthropic's official extension.
What happened — and when?
The attack began with an access key Cursor had issued to Fireworks AI, an external AI infrastructure provider. Cursor says the key was exposed by Fireworks and used to access a read-only storage bucket containing historical coding-agent traces, mostly from 2025. Some traces from sessions without Privacy Mode contained credentials that had not been redacted.
Those secrets enabled access to selected Cursor SaaS systems. From the compromised information, the attacker obtained another credential permitting malicious files to be placed in the cache serving Cursor's VS Code extension marketplace. On 29 October, tampered Anthropic.claude-code versions 2.1.312 and 2.1.313 were available there for approximately 11 hours before removal.
How did the malicious extension work?
Researchers identified injected JavaScript that ran when the extension loaded. It gathered system details and attempted to append an attacker-controlled public key to the user's SSH authorized_keys, activate SSH, create an outbound reverse tunnel and retain access through startup mechanisms. Windows and macOS persistence attempts included scheduled tasks or launch agents.
The attacker did not necessarily gain interactive access to every exposed computer. Cursor and Microsoft note that configuration errors and missing administrator privileges prevented some access steps on many systems. However, a failed SSH tunnel does not prove that no malicious artifacts were written, and uninstalling the extension alone may leave persistence behind.
Who was affected?
Cursor estimates that at most 5,000 users who requested the affected cached extension builds on 29 October could have received them. That is a potential exposure count, not a confirmed count of infected devices. Cursor separately reports that fewer than 0.05% of users had historical coding-agent traces exposed and fewer than 0.01% of customers had API credentials exposed. These are distinct measures of impact.
The incident involved Cursor's extension marketplace cache, not the legitimate Claude Code release distributed by Anthropic, the Microsoft Visual Studio Marketplace or Open VSX. Cursor states that customers' code repositories, production release infrastructure and code or prompts protected by Privacy Mode were not affected.
What should developers and security teams do?
Check whether Claude Code version 2.1.312 or 2.1.313 was installed or updated from the Cursor VS Code extension marketplace on 29 October 2026; verify provenance, not only the version number.
Follow Cursor's official verification and remediation advisory. Look for the unauthorized SSH key marker svc-telemetry and review the published endpoint and network indicators.
Isolate endpoints showing evidence of malicious execution. Remove persistence and unauthorized keys, investigate processes and connections, and consider rebuilding affected machines.
Rotate API keys, developer tokens and potentially exposed sessions from a trusted device after assessing impact; do not treat simple uninstallation as full remediation.
Review vendor access, secret redaction in AI-agent traces, least-privilege service accounts, extension provenance and monitoring for unexpected credentials.
Why this matters beyond Cursor
This attack crossed several trust boundaries: a supplier-held key, historical AI-agent data, credentials embedded in traces and a distribution cache trusted by developers. Even read-only datasets can become an attack path when they hold active secrets. For teams in Romania, the UK and elsewhere, the practical lesson is to protect AI development tooling as part of the software supply chain, rather than treating extensions as harmless productivity add-ons.
Status as of 15 November 2026: Cursor says it believes the incident is contained, last observed attacker activity was blocked on 1 November, and affected customers have been contacted. These are the company's findings, not proof that every potentially exposed endpoint is clean.
Primary sources and further reading
Cursor — official incident investigation, 13 November 2026
Cursor — affected extension versions and remediation instructions
Microsoft Security Research — technical analysis, 30 October 2026